Possible Trojan virus on Offical servers

[Snoop Duck]

After playing some casual today, my anti-virus found a Trojan in my Steam appcache. It might not be related to TF2, but it's the only game I've played today, so it seems like it is.

Here's where it was found: appcache\httpcache\65\650e2205bb9ddf2359d8b905805e67a5996e1c8a_da39a3ee5e6b4b0d3255bfef95601890afd80709

Does anyone smarter than me have an ideas on what it might be?

[Jesus Ezekiel Jesus]

willing to bet that tf2 was scanning community servers and storing info in the cache, it hurts to say but a lot of tf2 community servers have trojans and all that

[Snoop Duck]

Originally posted by Instagator:

willing to bet that tf2 was scanning community servers and storing info in the cache, it hurts to say but a lot of tf2 community servers have trojans and all that

Makes enough sense. Hopefully I can avoid this in the future, but if just looking at the server info is enough to get a trojan then it might just be safer to leave TF2 for a few days

[Shoobflops]

Originally posted by Viking Eagle:

Originally posted by Instagator:

willing to bet that tf2 was scanning community servers and storing info in the cache, it hurts to say but a lot of tf2 community servers have trojans and all that

Makes enough sense. Hopefully I can avoid this in the future, but if just looking at the server info is enough to get a trojan then it might just be safer to leave TF2 for a few days

You had it way before looking at server info.

[Alp]

I wish I didn't play it yesterday now I'm paranoid lol

[Snoop Duck]

Originally posted by Private Profile Cat:

Originally posted by Viking Eagle:

Makes enough sense. Hopefully I can avoid this in the future, but if just looking at the server info is enough to get a trojan then it might just be safer to leave TF2 for a few days

You had it way before looking at server info.

Phrased that poorly, I meant the computer itself storing the data from servers, like Instagator suggested

[Q]

i don't believe it's possible to get a virus just by opening the server browser, but if it is you should probably tell valve about that. something similar has happened once before and they fixed it quickly

[Jesus Ezekiel Jesus]

you mean the gmod cough thing

[Jesus Ezekiel Jesus]

also, depends on what type of antivirus you have. If you have one like malwarebytes, sophos, avast, bitdefender, or AVG then you might wanna do a full scan on your system. If you dont have one of those and have like "system restore pro" then dont worry

[Blumberquack]

most likely a false positive although i recall this exact scenario happening to me once many years ago, don't think it did anything. however, bitcoin miners are possible to run through html - my tf2 slowed to a crawl when i joined a community server once, after a couple seconds my antivirus quarantined it and it started running perfectly again.
find where it's located, delete it and do a scan just to be sure.

[hdmai]

almost certainly a false positive; the httpcache mostly contains cached images for things like user avatars and game/achivement icons

[OLDMAN🎅]

//------------------------------------------------
// TF2 Anti-Virus by Casual v1.1
//------------------------------------------------
// PLEASE READ THROUGH THIS FILE CAREFULLY BEFORE USE!
// It contains very important information to make full use of its features!
// I am not responsible for any damages usage of these instructions might cause!


//------------------------------------------------
// General tips
//------------------------------------------------
// By creating an alias with the same name as an existing ConVar or ConCommand you can prevent anyone from changing / executing that command.
// This config makes extensive use of it to prevent the server from modifying certain ConVars.
// Examples:
// alias unbindall "echo blocked!" - will prevent you from executing this command (by accident)


//------------------------------------------------
// AdBlock: pinion.gg
//------------------------------------------------
// Pinion is a popular advertising network which abuses Flash to play really annoying advertising in motds.
// Follow these steps carefully to disable them from working.
// NOTE! (20 Feb 2013) The guys from pinion have said that they will work on preventing this bypass from working so (part of) it may not work to your satisfaction!
//
// http://nopinion.tumblr.com/
// First we must prevent pinion from connecting to its host to load the ads,
// Add '127.0.0.1 motd.pinion.gg' to your hosts file, use google if you have any issues.
//
// There used to be a trick (creating an empty text file in your tf directory named textwindow_temp.html) to prevent the game from showing a html motd.
// While I've been advocating its use I think it stopped working when Valve switched to webkit for rendering the html. So ignore this advice :)
//
// Pinion also has an annoying feature that forces you to watch their ads for up to 20 seconds (it'll reopen the motd if you click continue too soon).
// Since we're already blocking their ads from loading there's no point for us to look at an empty screen.
// The way pinion works is by asking your client to execute a command 'closed_htmlpage' to notify the server when you click continue.
// No such command exists on your client and thus it'll forward it to the server, however by aliasing it we effectively hijack this command so the server will never know we got passed it!
// BUG: However doing so causes the motd (I don't know if pinion is doing this on purpose) to open by itself at random times during gameplay. To prevent this we have to issue a 'closed_htmlpage' command some time afterwards.
// Because we have already aliased it the only way for us to send this command to the server directly is with the 'cmd' command, bind it to a key or type it some time during gameplay.

cl_disablehtmlmotd 0
alias closed_htmlpage "echo Blocked pinion!"
alias ♥♥♥♥♥♥♥♥♥♥ "cmd closed_htmlpage"

//------------------------------------------------
// Aux features
//------------------------------------------------

// Gets rid of servers playing annoying sound files
// NOTE! This will also prevent the main menu from playing a song!
alias play "echo Blocked play!"
alias sndplaydelay "echo Blocked sndplaydelay!"
alias playgamesound "echo Blocked playgamesound!"
alias soundfade "echo Blocked soundfade!"

// Servers don't need this
alias cl_spec_mode
alias rpt_connect
alias r_screenoverlay


--------------------------------------------------------------------------------------------------------------------------------------

Look out! Steam trojan virus for custom TF2 servers
https://gadgetgaming.weebly.com/blogs/look-out-steam-trojan-virus-for-custom-tf2-servers

SourceProtect/protect.cfg
https://github.com/CasualX/SourceProtect/blob/master/protect.cfg